Hacked Files (100% Certain)

What this check and mySites.guru tool looks at on your site

Hacked Files lists every file on a Joomla site that is confirmed compromised, not merely suspected. A file lands on this list when one of three things is true: its full-file MD5 hash matches a file already confirmed hacked elsewhere, its filename matches a pattern seen only on attacker uploads (droppers, web shells, obfuscated cache files), or the scan detected a live compromise directly, such as a rogue administrator profile or a ransomware marker left on the filesystem.

That is the whole test. There is no scoring, no partial match, no “looks a bit off”. Either a file is byte-for-byte identical to something already proven malicious, its name belongs to a known attacker toolkit, or the site shows direct evidence of compromise. Nothing here is a guess.

Why nothing on this list needs a judgement call

This is the check to read first, and the one difference worth understanding before anything else on the site: the difference between Hacked Files and its sibling, Suspect Content.

Suspect Content matches a file’s content against a library of roughly 1,500 patterns built from years of hacker uploads, poorly written code and insecure implementations. It is deliberately broad. It expects false positives, because plenty of legitimate code uses the same PHP functions attackers use, and every entry needs a human to read it and judge.

Hacked Files is the opposite kind of list. It contains nothing that needs judging. A hash match means the file is identical, byte for byte, to a file already proven malicious on another compromised site. A filename match means the name itself is one only ever seen on a dropper, a shell, or a cache file an attacker planted. A live-compromise flag means the scan found direct evidence, not a pattern that merely resembles one. If this list is not empty, an attacker had write access to the site at some point, full stop.

That matters because it changes what you do next. A Suspect Content match asks you to read a file and decide. A Hacked Files match tells you the decision is already made: the file is bad, and the only open questions are how it got there and what else came with it. Treat one confirmed hacked file as evidence the whole site was compromised, not as an isolated bad file to quietly remove. Attackers who get in once rarely leave only one thing behind, and a hash match against a known signature only proves what we have seen before, not the limit of what they did on this particular visit.

An empty list, with a caveat

An empty list. Nothing on the site matches a known hash, a known attacker filename pattern, or a live compromise marker.

An empty list is good news, but it is not proof the site is clean. It only means nothing matched a signature we already know. A brand new backdoor with a hash we have never catalogued will not appear here; it may well appear in Suspect Content instead, flagged by its behaviour rather than its identity, which is exactly why the two tools exist side by side rather than as one blended list.

How to fix it

1. Do not delete on sight. A confirmed hacked file is often a legitimate core or extension file with one malicious line injected into it, not a file that is entirely malicious. Deleting the whole file can break the site as thoroughly as the hack did, especially if it is a core file Joomla or an extension expects to find.
2. Read the file, or diff it against the original. Compare it with the same file from a clean copy of Joomla or the extension it belongs to. If only a few lines differ, remove exactly those lines rather than the file.
3. Delete outright anything that is entirely an attacker’s creation. A web shell, a dropper, or an obfuscated file with no legitimate counterpart should simply be removed once you have noted its name and location for the next step.
4. Treat the whole site as compromised, not just the listed files. Change every password: the Joomla administrator account, FTP, the database, and the hosting control panel. Update Joomla, your template and every extension to the latest version. Then run a fresh audit and confirm the list comes back empty. If this is your first cleanup, dealing with a hacked Joomla site covers the same recovery steps in more depth.
5. If you are not confident doing this yourself, https://fix.mysites.guru/ is a fixed-fee GBP 120 cleanup, usually completed the same day, and it is screened before work starts so you are not charged if it turns out the site cannot be fixed.

What mySites.guru does about it

There is no one-click fix for a confirmed hacked file, deliberately: removing malicious code from inside an otherwise legitimate file is not something to automate, and an outright malicious file still needs a human decision about what it touched before it goes. Checking every file on the site takes real time, so this runs as part of the full audit rather than the fast twice-daily snapshot; audits run weekly by default, or daily or monthly depending on what you set for the site. Every match is flagged automatically and shows you exactly which of the three tests it matched, alongside the Suspect Content list for anything that only looks suspicious rather than being confirmed.